It's still impossible to prove the files were deleted even if they don't release after the initial payment. All it takes is a single individual in a group to make a backup or have a default policy of keeping a backup "just in case".

One should assume at this point that it's not a question of whether the files will be leaked but when.

Even in that case, do you think the ransom group’s security is better than their target?

The likelihood that one particular group will ransom more than a handful of times decreases exponentially as LEO becomes more interested.

If one group got it, there's no reason to assume another group didn't also get to it first and simply sat on the data. There's also no reason to assume the group holding your data ransom is acting as a single reasonable entity: it could be a group of people, each with a copy, who all have different opinions on what to do.

that may have been true 10 years ago but the vast number of criminals in the ransomware game renders having a good reputation meaningless.

doesnt most of them operate as franchaises these days?

When the time comes to retire, a criminal can sell the brand name they have built, sell the accumulated data they have backed up, or keep the backup as a bargaining chip. Of course, they might have already needed to leak all the data to the local authorities in exchange for protection. Or their employees might have made copies. Unlike kidnapping, data can be ransomed many times. You are paying just to delay the leak, hopefully until after you have retired and it is someone else's problem or people have stopped caring. And if you never publicly announced the leak, hopefully until after you are dead and nobody can sue you for securities fraud or similar.

That can replace PCI compliance then. Sounds like a better option